The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to perform actions on repositories.
Evidence: The workflow involves executing gh pr view to retrieve PR metadata and gh pr comment to publish the generated plan.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources (GitHub PRs and review outputs).
Ingestion points: The skill ingests data from gh pr view (title, URL, branch names) and the output of the review-pr skill which may contain attacker-controlled code or comments.
Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious embedded prompts within the ingested data.
Capability inventory: The skill has the capability to write back to the system via gh pr comment.
Sanitization: No sanitization, validation, or escaping of the external content is mentioned before it is interpolated into the plan and posted as a comment.
[METADATA_POISONING]: There is a contradiction between the YAML frontmatter and the actual behavior defined in the workflow.
Evidence: The YAML frontmatter lists sideEffects: [], whereas the workflow explicitly describes posting comments to GitHub using gh pr comment. This inconsistency could lead to a misunderstanding of the skill's impact on external systems.

plan-review-fixes